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1CO’s call for views on building a sandbox: summary of 
responses and I CO comment 


Introduction 


In September 2018 the ICO issued a call for views to inform the development of 
our regulatory sandbox. A copy of the survey we used is at Annex A. 


Our survey covered what we considered to be some of the key issues we needed 
to consider in starting to take forward this work, and posed a number of open 
questions. 


Overall we received 65 responses, broken down as follows: 


Data subjects - 5 

Business/commercial enterprises - 41 

Public authorities - 3 

Third sector/voluntary organisations - 6 
Trade associations/representative bodies - 6 
Other - 4 


A wide variety of issues were raised with considerable detailed thought having 
been given to many of the responses. There were many detailed practical 
suggestions on how the sandbox might function and we are grateful to all those 
who took time to provide input. 


Some respondents provided detailed case studies and examples of where they 
had undertaken work in similar areas, such as in creating incubators or 
accelerator programmes for start-ups, and these will be helpful in informing our 
development of the sandbox. 


Similarly a number of respondents gave examples of key innovations that would 
have benefited from sandbox involvement or might in the future, and these too 
will provide a very helpful set of ‘use-cases’ for us to think through as we test 
and develop sandbox mechanisms. 


Whilst we cannot reply to each respondent we have provided an analysis of the 


key themes raised, and some comments throughout on our emerging thinking, 
in each of the key areas covered by the survey. 


Key themes 


General themes 


Across the responses some general themes emerged over and above the specific 
questions we posed. 
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Firstly, we had an overwhelmingly positive response to the concept of us 
creating a sandbox. Many welcomed the opportunity to work in this way - 
sharing the goals of both supporting privacy and innovation - and recognising 
that spaces and investment like this are needed to support innovation. 


Many also acknowledged the Financial Conduct Authority’s (FCA) Sandbox as a 
sensible point from which to start, but were keen to highlight the differences it 
and an ICO sandbox; and in particular the differences in the regulatory regimes 
- and in some of the specific requirements in dealing with personal data. 

A large number of responses, in various forms, expressed the desire to proceed 
along a basis of constructive engagement between the ICO and those that might 
participate in the sandbox - and the desire to see the sandbox itself evolve and 
develop over time as result. A few respondents wanted to make sure that we 
didn’t end up seeing the sandbox as its only way of providing constructive 
engagement, but that we should see it as one up a number of possible channels. 


Many responses reflected the need to ensure that there were specific safeguards 
in place covering eligibility and conduct whilst in the sandbox, and in what can 
and can’t be communicated about participation in the sandbox. Clarity over the 
relationship between our work with the sandbox and our wider regulatory action 
such as enforcement and requirements such as Data Protection Impact 
Assessments (DPIAs) was also requested. A number of organisations highlighted 
the need to consider carefully the commercial confidentiality of participants and 
the implications of the sandbox for freedom of information. 


We received a very small number of critical comments, which mainly raised 
concerns that the sandbox could be used to endorse non-compliance with data 
protection legislation. 


ICO Comment 


We are encouraged to see the levels of support for this initiative and 
recognise the key points made and the differences with the FCA Sandbox. We 
will ensure robust safeguards, clarity over the relationship with our other 
powers and regulatory requirements, and put in place mechanisms to protect 
the commercial confidentiality of participants whilst meeting our requirements 
under freedom of information. The sandbox will not be used to endorse non- 
compliance with DP legislation but to support innovation in a manner that is 
compliant. 


We fully expect the sandbox itself to evolve and change over time. We see 
the creation of the sandbox as an enhancement of our role and not therefore 
a substitution of our other ‘constructive engagement’ based activity. 
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Perceived barriers and challenges to innovation 


Views varied as to whether the General Data Protection Regulation (GDPR), Data 
Protection Act 2018 (DPA2018), or the |CO’s approach to its role as a 
supervisory body, presented particular challenges to innovation. 


The overwhelming majority of perceived barriers raised pertained to 
understanding what the correct application and interpretation of GDPR and 
DPA2018 should be in particular contexts and hence what should be permitted. 


These included a number of interesting and challenging areas that related to 
innovation, such as: 


e use of personal data in emergent or developing technology including 
biometrics, internet of things, wearable tech, cloud-based products; 

e using live personal data and building in privacy into live test 
environments; 

e complexity of sharing data at any and all levels, whether within country or 
in cross-border transfers and dealing with different jurisdictions; 

e balancing good user experience and public trust with ensuring 
transparency, clarity and ‘explainability’ of data use; 

e perceived limitations, or lack of understanding of, implications of GDPR 
and DPA18 for automated decision making, machine learning or artificial 
intelligence (Al); 

e utilising and repurposing existing data - often at scale and in linking data 
- for new uses such as learning analytics, health research, or tailored 
product or service development; 

e achieving privacy by design early in product development, when this may 
generate costs or not be possible until testing has been undertaken. 


Some potentially more basic issues, such as identifying whether data is in fact 
personal, were also raised. A small number of respondents also indicated that 
there may be a general chilling effect on people sharing or manipulating data in 
a way that might be beneficial for innovation. 


Very few respondents however indicated that |CO’s approach to regulating 
presented a specific challenge to innovation; with the clear majority stating that 
it do not present any particular barriers. Where potential issues were raised they 
tended to fall into the following main areas: 


e requesting more specific and timely guidance on application of the GDPR 
and DPA2018 in particular contexts; 

e greater clarity and consistency in how we will respond to particular 
circumstances or queries raised, and in doing so publicly so that shared 
understanding is developed. 
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Some respondents also indicated that the challenges that small new innovative 
organisations face innovating with personal data needed particular consideration. 
These included issues such as: 


e dealing with technical complexity created in things like contracts in 
reaction to GDPR; 

e showing that they can be trusted with personal data; 

e having the skills and knowledge -whether technical or not - to be able to 
innovate safely with personal data. 


ICO Comment 


The GDPR and DPA2018 are principle-based and require organisations to 
take accountability for applying them in their context and demonstrating 
their compliance. We understand that this presents challenges and are 
committed to assisting through the provision of toolkits, checklists and 
where appropriate supporting guidance. We will continue to endeavour to 
do this in a timely and consistent manner. 


Many of the answers as to how best to apply the GDPR will rest with 
organisations and sectors themselves. The GDPR creates the opportunity 


for sectors to come together to create codes of conduct that will provide 
practical application of the GDPR and we welcome dialogue with any 
sector that wishes to make progress in this manner. The sandbox itself 
presents an opportunity to test approaches to addressing these challenges 
and in some circumstances that could then inform the creation of sector- 
specific codes of conduct. 


We are keen to ensure the sandbox develops in such a manner as to be 
as accessible to small start-up organisations as to large incumbents, and 
everything in between. 


Scope 


Perhaps understandably many respondents from organisations were keen to see 
that the sandbox would be open to the organisations like their own, with a small 
number suggesting that there should be industry-specific sandboxes. Some 
respondents however were keen that the sandbox was more broad - reflecting 
the cross cutting nature of personal data and some of the shared challenges. 


Sectors that we may have expected to show a strong interest did so, with a clear 
majority of the business and commercial responses coming from within the 
digital and technology sectors. Particular sectors referenced where innovation 
could benefit from the existence of the sandbox included: 


e Health and social care sectors. 
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Online advertising and direct marketing. 
Energy. 

Telecommunications. 

Financial services and Fin Tech. 


Particular cross-cutting data protection issues that were raised as areas that 
would benefit from inclusion in the sandbox included: 


e achieving safe data sharing and portability and analysis to support the 
provision of services or charitable or educational interventions; 


e methods of evidencing data protection compliance such as evidencing 
consent and providing supporting documentation; 


e the use of personal data in emerging and developing technologies like 
internet of things, automated vehicles, artificial intelligence, blockchain; 


e the use of special category data, and in particular managing the consent 
of test groups; 


e purpose limitation and compatibility assessment in the context of machine 
learning. 


One recurrent theme was the need to ensure that the sandbox focused on 
ensuring benefits were delivered to the end users of the products and services - 
whether these were defined as customers, patients, citizens or the general 
public. 


ICO Comment 


We are currently of the view that the sandbox should be broad in scope and 
open to all sectors and to all types of innovation. We are though 
considering specifying some areas of focus where we would particularly 
welcome applications - and which these responses will help inform. 


We agree - as suggested by some - that we should however limit that 
scope to those products and services that can demonstrate: 


1) that they represent genuine innovation; 


2) that they can demonstrate material benefit to data subjects; 


3) that they have in place a robust accountability framework for working 
with personal data. 
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Benefits of involvement 


Respondents recognised the benefits we set out in the call for views as being the 
key potential benefits. By far the most frequent benefit cited was access to ICO 
expertise, guidance and support. 


Respondents in particular suggested that an open and collaborative approach 
would be beneficial - solving challenges in a spirit of cooperation and 
constructive engagement with the regulator. Using the sandbox to come to 
shared understandings of how the GDPR can be applied in various different 
contexts was often referred to as being one such key benefit. 


Some respondents were keen to emphasise the benefits that involvement might 
have in mitigating design risk at early stages of product and service 
development. Others focused on the role that the sandbox could play in 
enhancing trust - whether that was from investors, the public or from local or 
national government. 


A small number of respondents wished to see some form of badge or certificate 
be awarded for participation in the sandbox. 


ICO Comment 


We recognise the overwhelming feedback that the main benefit sought 
would be for ICO expertise, support and guidance and see the sandbox 
developing with a range of mechanisms that fall largely in this area. We do 
not envisage providing technological solutions or platforms through the 
sandbox. 


We do also recognise the benefits that participation could bring for 
organisations in creating enhanced trust in their product or service. Whilst 
we will not provide a ‘badge’ or certification as a result of the sandbox we 
are keen to explore what forms of communication, such as letters 
acknowledging entrance and exit to the sandbox, or other mechanisms 
there may be to contribute to this enhanced trust. 


Sandbox mechanisms 


By far the most frequently requested sandbox mechanism was the provision of 
informal steers, advice, or guidance from ICO. There were many suggestions as 
to what form this might take including: 
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e phased or iterative advice - from idea, concept to prototyping and then 
into supervised product or service testing; 

e process walkthroughs - step by step walkthroughs of proposed processing 
activity; 

e video drop-in or workshops with design and development teams at an 
early stage in order to inform very early thinking; 

e advice on risk mitigation at design stage; 

e creation of generic guidance from issues raised out of sandbox 
participants - whilst being careful with commercial confidentiality. 


Some respondents actively welcomed the suggestion of letters of comfort or 
negative assurance if these could be done in timely and clear enough manner 
and in a way that was meaningful. 


A few organisations highlighted the potential for utilising the sandbox to provide 
an environment in which testing using live personal data may be more accepted. 


As in respect of possible benefits a small number of organisations requested 
some form of certification or positive assurances about the safety of products or 
services that have been through the sandbox. 


Some responses suggested that the sandbox should be a place to explore 
legislative approaches, contrasting approaches that either remove requirements 
that may be barriers and those that add support or new legal principles to 
enable regulatory requirements to be met such as in relation to areas of Al such 
as machine learning 
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ICO Comment 


The advice or informal steer-based mechanisms raised all seem to have 
potential. Our current thinking is that sandbox mechanisms will largely be 
based around such advisory and collaborative processes and that sandbox 
mechanisms will be developed for each participant in a bespoke sandbox 
plan - working to defined objectives and timescales and drawing such 
mechanisms from an indicative list. 


Within such plans we see the possibility for permitting testing which makes 
use of live data, and at this stage envisage considering these on a case-by- 
case basis and only if risks can be effectively mitigated. 


We will also continue to develop our thinking on what role letters of comfort 
or negative assurance may play. 


We do not envisage the sandbox being a place to relax requirements for 
compliance, or to provide any certification or positive assurances as result 
of sandbox participation. That said, it should be possible through the 
sandbox to explore emergent areas and consider what additional provisions 
may be needed - and to provide support and guidance to organisations 
working in these areas - in achieving the shared goals of privacy and 
innovation. 


Sandbox timings 


A clear majority of participants encouraged us to ensure that the sandbox was 
first and foremost flexible and accessible in its approach to timings. Many 
stressed the need for an ‘always open’ approach due to the variability of 
development cycles and the fact that these were unlikely to fit with a 
standardised cohort model. 


Flexibility was also requested by many in the duration of sandbox participation 
with some wanting to build a relationship iteratively over a long period of time 
and others welcoming short more intense periods of engagement. Some 
recognised the need still for ICO to have some boundaries on this, both in terms 
of managing resource and in terms of ensuring positive meaningful engagement 
was maintained. 


There was some support also for the use of a pilot or test phase - though some 
notes of caution were also struck particularly in relation to how participants 
would be treated in any such phase and some uncertainty of the status of steers 
received within any such phase. 
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A few respondents wanted to see the sandbox as an opportunity for collaborative 
innovation with groups of organisations coming together to work on innovative 
products and services together, and potentially sharing this process with other 
interested stakeholders from Government or elsewhere. Others were keen to 
ensure that it was focussed on individual organisations, with a key concern being 
ensuring commercial confidentiality. Understandably this difference reflected the 
public and private nature of the organisation responding. One interesting 
suggestion was to permit both models - either single organisation in closed 
model or group participation in an open model. 


A few respondents - far less than those wanting high levels of flexibility - 
supported more of a cohort based model, though in all cases this was less of a 
timing related issue and more of a desire to either see cohorts structured around 
specific policy goals or around particular sectors. 


A few respondents fed back on the notice that organisations would need that the 


sandbox was opening, with estimates between four to six week as a minimum 
and three months as the longest. 


ICO Comment 


Our current ambition is to open the sandbox as planned next financial year 
with a year-long ‘live beta’ phase. Our ambition is then that, as the 
sandbox develops and initial demand evens out, that it becomes in principle 
an ‘always open’ service that welcomes and assesses applicants on a case 
by case basis against defined criteria and subject to ICO resources being 


available 


We will encourage early engagement and discussion to ensure that 
participants understand the parameters before applying and will work with 
potential applicants to ensure they understand the requirements. We will 
also ensure that every bespoke sandbox plan has a defined timescale within 
it to prevent open-ended commitments. 


Managing demand 


Many respondents recognised the need we are likely to have to actively manage 
demand and confirmed the suggestions we made in the question were feasible. 


One common response was to suggest we specify priority areas - with 
suggestions as what these should be, closely linked to responses provided on 
what the scope of the sandbox should be. These included: 


e prioritising applicants that focus on particular challenges with data 
protection; 

e restricting entrance to particular sectors in which personal data is a major 
issue; 
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e trying to make the sandbox reflect the mix of companies and 
organisations in the UK - with defined numbers in defined areas. 


The need for clear transparent criteria in any such prioritisation was stressed by 
a number of respondents, again linked to defining the possible scope of the 
sandbox. Whilst there were many suggestions for eligibility criteria these tended 
to fall into three main categories: 


e Public/consumer benefit criteria - ensuring benefit to the end user of any 
product or service in the sandbox. 


e Innovation criteria - ensuring that products and services were genuinely 
innovative and not just ‘business as usual’. 


e Fitness to participate - ensuring that participants were fit to do so eg in 
terms of having accountability frameworks, being ready to test, and being 
fit and proper organisations more generally. 


Some respondents also referenced analysis of risk as being a way of managing 
demand; and in particular prioritising those innovations that present particular 
risks to data protection. 


A small number of applicants connected their suggestions on managing demand 
to the availability of resources to the organisations wishing to be involved. For 
example suggesting that organisations with limited access to their own 
development funds should be prioritised, or conversely suggesting that 
participants should prove they have the necessary funding in place to ensure 
that time spent in the sandbox was not wasted. 


Views were mixed on whether cost recovery would be feasible; some arguing 
that participants may ultimately benefit, though not immediately or directly, 
commercially from being involved and that it would be reasonable to recover 
costs, whereas others indicated that this could in effect prevent small innovative 
organisations participating. Where respondents indicated that cost-recovery was 
feasible some form of flexible or tiered system was suggested to reflect the 
different organisations applying. 
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ICO Comment 


We envisage demand primarily being managed by the use of entry criteria 
being shaped around the three main areas suggested by respondents: 
public benefit, innovation and fitness to participate. 


In the live beta we expect there to be an early surge in demand for 
involvement and so will set a date by which initial applications to be in the 
beta phase will need to be submitted and that we will then assess by a set 
date. Number of participants will be set by availability of ICO resource and 
numbers of participants meeting the required criteria. 


We will not charge for involvement in the sandbox during the live beta 
phase but will continue to consider it as an option for the future. 


Next steps 


We will use this feedback to contribute to our work developing an operational 
model how we expect the sandbox to function. We remain committed to opening 
the sandbox next financial year and we are planning to undertake some 
roundtable consultation events to explore some of the key issues early in the 
New Year. Further details regarding these events will be publicised on our 
website. 


We also remain committed to building the sandbox transparently, in consultation 
and constructive engagement with stakeholders, and in such a way that 
fundamentally protects the rights of the data subject whilst supporting 
innovation in the use of personal data. 


If you wish to discuss the sandbox with us please get in touch via 
sandbox@ico.org.uk 
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Annex A 


ICO call for evidence - Regulatory 7 
Sandbox 1CO. 


The Information Commissioner (the Commissioner) is calling for evidence 
and initial views on creating a regulatory sandbox. 


The 1CO’s Technology Strategy for 2018-2021 sets out that we intend to 
establish a regulatory sandbox. The ICO sandbox will be a safe space 
where organisations are supported to develop innovative products and 
services using personal data in innovative ways. They won’t be exempt 
from complying with data protection law, but they will have the 
opportunity to engage with us; drawing upon our expertise and advice on 
mitigating risks and data protection by design, whilst ensuring that 
appropriate protections and safeguards are in place. 


This call for evidence is the first stage of the consultation process. The 
Commissioner seeks early evidence and views on the feasibility, scope 
and demand for a sandbox. This will be used to inform our detailed 
proposal for consultation later in the year. The Financial Conduct 
Authority (FCA) sandbox has been a key point of reference in this early 
part of the process but we are aware there are other options and views 
and we wish to gain as wider viewpoint as possible at this early stage. 


The Commissioner is particularly interested in evidence based 
submissions provided by organisations that are developing innovative 
products and services using personal data in innovative ways. She 
appreciates that different stakeholders will have different and particular 
areas of expertise. The Commissioner will use the evidence gathered to 
inform further work in developing the Sandbox. 


You can email your response to Sandbox@!CO.org.uk 
Or print and post to: 


Sandbox Call for Evidence 
Assurance Department 
Information Commissioner’s Office 
Wycliffe House 

Water Lane 

Wilmslow 

Cheshire SK9 5AF 
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If you would like further information on the call for evidence, please email 
the Sandbox@ICO.org.uk team. 


Please send us your views by 12 October 2018. 
Privacy statement 


For this call for evidence we will publish responses received from 
organisations but will remove any personal data before publication. We 
will not publish responses from individuals. For more information about 
what we do with personal data please see our privacy notice. 
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Questions 


Barriers and Challenges 


Q1 What, if any, barriers or challenges to developing innovative 
products and services in particular do you perceive as a result of the 
General Data Protection Regulation (GDPR)/Data Protection Act 
2018 (DPA18). Please provide specific examples where possible. 


Q2: Are there any perceived barriers or challenges to developing 
innovative products and services created by the |CO’s regulatory 
approach as a Supervisory Authority? Please provide specific 
examples where possible 


Possible scope of an ICO Sandbox 
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Q3 Data protection cuts across all sectors. Whilst we expect a key area 
of focus to be digital innovation, we would like views on the key 
areas of innovation, new technologies, or specific sectors that may 
be most helpful for the Sandbox to focus on. Please provide specific 
examples where possible. 


Understanding the benefits of involvement 


Q4 Sandbox participation needs to be beneficial to participants to be 
meaningful. Please indicate what specific benefits from being involved in 
the sandbox would be of most importance to you. These could include: 


e Reputational/publicity benefits gained through involvement 
e Access to ICO expertise to aid in product/service development 


e Enhanced trust in data protection approaches from potential 
customers, investors and/or internal decision makers regarding 
product/service viability 


e Increased reassurance for individuals who may be affected by the 
proposed developments 
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Sandbox Mechanisms 


Q5 What mechanisms would be most useful within the sandbox? Please 
provide specific examples where possible. Examples of possible 
mechanisms include: 


o Advice or ‘informal steers’ early in the development process 
on how to address data protection and information rights 
issues in developing innovative products and services 


o Adaptations to regulatory guidance, assurance and 
enforcement approaches - ONLY where legally permitted and 
with appropriate safeguards in place. Examples of such 
adaptations include: 


= Provision of ‘letters of comfort’ stating that any 
inadvertent contravention of data protection principles 
during the sandbox period will not lead immediately to 
action 


= Provision of a negative confirmation to the effect that, 
at the point at which the product or service being tested 
transitioned out of the sandbox, on the basis of the 
information provided, there was nothing to indicate that 
its operation would breach data protection legislation. 


o Anticipatory guidance on addressing data protection 
challenges in specific areas of emerging technology and 
innovation e.g. including development of relevant codes of 
conduct 
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Sandbox Timings 


Q6 We understand that timing is crucial in the decision to move into 
testing, to invest in development, or to resource new projects. Awareness 
of the existence of the sandbox, knowledge of its parameters, and when it 
is open to participation, is therefore likely to be a key variable in those 
decisions. 


Please provide any views you have on how we can best manage the 
timings of our sandbox to support innovation. For example, 


e How much notice of the operational parameters of the sandbox is 
likely to be needed to inform decisions to participate? 


e Should entry to the sandbox be restricted to specific ‘windows’ of 
time with participation through the sandbox happening as a group 
e.g. as a ‘cohort’ of participants? Or on an individual basis? 


e Or should entry be flexible to fit with specific product/service 
development cycles? 


e Would a pilot or test phase be attractive to participate in? 


Managing Demand 


Q7 Experience from the FCA sandbox suggests that there may be 
considerable demand from organisations to participate in a regulatory 
sandbox. Whilst we are keen to meet these demands we will need to 
balance this appropriately against delivering our core regulatory activities. 
It may be therefore that we will need to manage demand. If this were to 
happen, approaches to address this could include: 
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Specifying priority sectors/areas in which we would want to see 
participation 


Specifying priority types of organisations from whom we would want 
participation (e.g. by size/type) 


Setting a maximum number of participants via 
o adefined cohort model as described above, 
o acap which when reached closes the sandbox 


Developing a cost-recovery model to fund the sandbox 


Please provide any views you have on how we might best manage 
demand. 


Further views 


Q8 


Please provide any further view you wish on the development of a 
regulatory sandbox 
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About you: 


Are you answering these questions as? 

A representative of a business or commercial enterprise 

A representative of a public authority 

A representative of a third / voluntary sector organisation 

A representative of a trade association or representative body 
A data subject 

Other 
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Q10 If other please specify: 


Q11 Please provide more information, including the name and the type 
of organisation you work for, ie a digital start-up, a large tech firm, a 
public body 


Q12 We would like to hear of expressions of interest in our work 
developing a sandbox and in potential involvement in the sandbox when it 
opens. 


Please note involvement in the sandbox would be conditional on meeting 
any specified conditions of entry. 


If you wish your interest to be noted with a view to further contact please 
provide an appropriate contact and their contact details: 


PO 


Thank you for taking the time to share your views and suggestions 


